ci: add automated SEO & crawl audit workflow for landing page - #229
ci: add automated SEO & crawl audit workflow for landing page#229amankv1234 wants to merge 8 commits into
Conversation
github-actions
Bot
added
no-issue-linked
|
Warning Review limit reached
Next review available in: 54 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughThe pull request adds a GitHub Actions workflow for landing-page audits. It runs link checks, Lighthouse audits, and Python validation for HTTP status, response timing, canonical URLs, heading count, and JSON-LD markup. ChangesSEO audit automation
Estimated code review effort: 3 (Moderate) | ~15–30 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant AuditTools
participant LandingPage
GitHubActions->>AuditTools: Run link, Lighthouse, and Python audits
AuditTools->>LandingPage: Request and inspect the landing page
LandingPage-->>AuditTools: Return links, metrics, and HTML
AuditTools-->>GitHubActions: Report audit results
Suggested labels: Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/seo-audit.yml:
- Around line 3-8: Add a workflow-level concurrency configuration near the
existing triggers in the SEO audit workflow, using github.ref as the group key
and enabling cancel-in-progress so superseded push or pull-request audits are
cancelled while the newest run continues.
- Around line 38-40: Update the “Install Advanced Audit Dependencies” step to
install from a committed constraints or requirements file containing tested
package versions for requests, beautifulsoup4, and extruct, invoking pip through
python -m pip. Remove the unpinned package installation while preserving the
workflow’s dependency setup.
- Around line 14-15: Update the actions/checkout@v4 step in the SEO audit
workflow to set persist-credentials to false, ensuring the GITHUB_TOKEN is not
retained in the repository’s Git configuration for later steps.
- Around line 10-12: Add a top-level permissions declaration in the workflow,
setting contents to read and leaving all unspecified permissions disabled. Keep
the existing seo-and-crawl-audit job configuration unchanged.
- Around line 49-50: Update the HTTP probe in the workflow’s Python request
logic to pass an explicit connect-and-read timeout tuple to requests.get, while
preserving the existing URL and Googlebot User-Agent headers.
- Around line 24-30: Update the “Run Lighthouse Audit” step to reference a
checked-in Lighthouse CI configuration through configPath, and add that
configuration with error-level score assertions for accessibility, best
practices, SEO, and performance. Use the repository’s existing workflow/config
conventions and preserve the current audited URL and artifact uploads.
- Around line 59-62: Update the canonical tag check to collect all
rel="canonical" elements, require exactly one, and validate that its href is
non-empty and normalizes to https://social-share-button.aossie.org/. Replace the
current soup.find() existence-only assertion while preserving clear failure
messages for missing, duplicate, or incorrect canonical values.
- Around line 52-55: Update the server-status test around the response.elapsed
TTFB measurement to define a clearly documented TTFB budget and assert that
response.elapsed.total_seconds() does not exceed it, while preserving the
existing HTTP status assertion and diagnostic output.
- Line 15: Update the workflow action references in seo-audit.yml, including
actions/checkout, GayanPradeep/broken-links-crawler,
treosh/lighthouse-ci-action, and actions/setup-python, to use their
corresponding full 40-character immutable commit SHAs instead of version tags;
preserve each action version’s behavior and leave future SHA updates subject to
review or automation.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e00e8abe-7a3c-45c5-bd0c-6290bdfcceec
📒 Files selected for processing (1)
.github/workflows/seo-audit.yml
| - name: Run Lighthouse Audit | ||
| uses: treosh/lighthouse-ci-action@v11 | ||
| with: | ||
| urls: | | ||
| https://social-share-button.aossie.org/ | ||
| uploadArtifacts: true | ||
| temporaryPublicStorage: true |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n --hidden --glob '!**/.git/**' \
'treosh/lighthouse-ci-action|lighthouserc|configPath|assertions|budgetPath' .Repository: AOSSIE-Org/SocialShareButton
Length of output: 249
🌐 Web query:
treosh lighthouse-ci-action v11 default assertions configPath uploadArtifacts CI fail workflow
💡 Result:
To configure treosh/lighthouse-ci-action v11 (or later) to perform CI assertions and manage artifacts, you should use the configPath and uploadArtifacts inputs in your workflow [1][2][3]. When you define assertions in a lighthouserc file (referenced by configPath), the action will automatically evaluate these assertions, and the CI workflow will fail if any assertion set to "error" is not met [1][4][5]. Key configuration details: 1. configPath: Use this input to specify the path to your lighthouserc file (e.g.,./lighthouserc.json) [4][5]. This file provides full control over LHCI assertions [4]. Example lighthouserc.json: { "ci": { "assert": { "assertions": { "categories:performance": ["error", { "minScore": 0.6 }] } } } } [4] 2. uploadArtifacts: Set this to true to save the Lighthouse reports as GitHub Actions artifacts [1][4]. This is helpful for debugging or persistent storage of results [4]. Example workflow step: - name: Audit URLs uses: treosh/lighthouse-ci-action@v11 with: urls: 'https://example.com/' configPath: './lighthouserc.json' uploadArtifacts: true [4][5] Troubleshooting workflow failures: If your workflow fails unexpectedly, check if you are using includePassedAssertions: true in your lighthouserc. In some older versions of this action, the presence of passed assertions in the results could cause the action to incorrectly report a failure [6]. Additionally, ensure that your assertions are correctly categorized as "error" if you intend for them to break the build; "warn" will typically report the issue without failing the workflow [4].
Citations:
- 1: https://github.com/treosh/lighthouse-ci-action
- 2: https://github.com/treosh/lighthouse-ci-action/blob/main/README.md
- 3: https://googlechrome-lighthouse.mintlify.app/advanced/ci-integration
- 4: https://github.com/treosh/lighthouse-ci-action/tree/refs/heads/main
- 5: https://github.com/treosh/lighthouse-ci-action/blob/main/.github/workflows/LHCI-assert-on-lighthouserc.yml
- 6: Action incorrectly failing when using
includePassedAssertionstreosh/lighthouse-ci-action#130
Fail CI on Lighthouse score thresholds.
This step uploads artifacts but does not provide configPath, assertions, or score thresholds, and the repo has no checked-in Lighthouse CI config. Add a checked-in Lighthouse CI configuration with error-level assertions for accessibility, best practices, SEO, and performance, then pass it with configPath so low scores fail the workflow.
🧰 Tools
🪛 zizmor (1.29.0)
[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/seo-audit.yml around lines 24 - 30, Update the “Run
Lighthouse Audit” step to reference a checked-in Lighthouse CI configuration
through configPath, and add that configuration with error-level score assertions
for accessibility, best practices, SEO, and performance. Use the repository’s
existing workflow/config conventions and preserve the current audited URL and
artifact uploads.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
|
@CodeRabbit, explaine me review given by socket-security |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/seo-audit.yml:
- Around line 21-24: The SEO audit workflow currently checks production for pull
requests instead of the checked-out revision. Update the workflow steps around
the checkout and URL references on lines 30, 37, and 60 to build and serve the
checked-out landing page or consistently use its deployment-preview URL for
pull_request runs, while retaining production smoke tests only for push and
manual triggers.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e163827b-3588-4533-a049-09a6bcce19b5
📒 Files selected for processing (3)
.github/requirements-audit.txt.github/workflows/seo-audit.yml.lighthouserc.json
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="AOSSIE-Org/SocialShareButton"
pr="229"
echo "== Pull request reviews =="
gh api "repos/$repo/pulls/$pr/reviews" --paginate \
--jq '.[] | {user: .user.login, state: .state, body: .body, submitted_at: .submitted_at, html_url: .html_url}'
echo
echo "== Pull request review comments =="
gh api "repos/$repo/pulls/$pr/comments" --paginate \
--jq '.[] | {user: .user.login, path: .path, line: .line, body: .body, html_url: .html_url}'
echo
echo "== SEO workflow =="
sed -n '1,220p' .github/workflows/seo-audit.ymlLength of output: 39424 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="AOSSIE-Org/SocialShareButton"
pr="229"
head_sha=$(gh api "repos/$repo/pulls/$pr" --jq '.head.sha')
echo "== Pull request issue comments from Socket =="
gh api "repos/$repo/issues/$pr/comments" --paginate \
--jq '.[] | select((.user.login | ascii_downcase | contains("socket")) or (.body | ascii_downcase | contains("socket"))) | {user: .user.login, body: .body, html_url: .html_url}'
echo
echo "== Check runs on PR head =="
gh api -H "Accept: application/vnd.github+json" \
"repos/$repo/commits/$head_sha/check-runs" --paginate \
--jq '.check_runs[] | select((.name | ascii_downcase | contains("socket")) or (.app.slug | ascii_downcase | contains("socket"))) | {name: .name, app: .app.slug, status: .status, conclusion: .conclusion, details_url: .details_url, output: .output}'
echo
echo "== Commit statuses on PR head =="
gh api "repos/$repo/commits/$head_sha/status" \
--jq '.statuses[] | select(.context | ascii_downcase | contains("socket")) | {context: .context, state: .state, description: .description, target_url: .target_url}'Length of output: 24903
What Socket foundThe new workflow adds these direct Python dependencies:
Socket gives these direct packages a vulnerability score of 100, so it does not report a known vulnerability in them. However, Socket flags Socket displays the alert twice because it detected it in both package formats:
This is one underlying dependency concern, not two separate packages. Security impactThis does not prove that the project is compromised. It is a supply-chain risk that needs review. The affected package runs in the GitHub Actions SEO audit workflow. It does not become part of the deployed landing-page application. The workflow also reduces the impact because it uses: permissions:
contents: readand: persist-credentials: falseRecommended actionDo not ignore the alert without review.
The Socket check is marked 🐇🔍 You are interacting with an AI system. |
|
@CodeRabbit, how to solve the give explaine by you in above |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Workflow outline =='
ast-grep outline .github/workflows/seo-audit.yml --items all || true
printf '%s\n' '== SEO audit workflow =='
cat -n .github/workflows/seo-audit.yml
printf '%s\n' '== Audit requirements =='
cat -n .github/requirements-audit.txt
printf '%s\n' '== extruct and pyrdfa3 references =='
rg -n -C 4 --hidden -g '!**/.git/**' '\b(extruct|pyrdfa3)\b' .Length of output: 7068
The workflow only uses Remove the flagged dependency and validate JSON-LD directly
You are interacting with an AI system. |
|
@CodeRabbit, Check this i have update the code whatever you had suggested to me to change and let me know if any issue |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Changed files =='
git diff --name-status "$(git merge-base HEAD origin/main)" HEAD
printf '%s\n' '== Audit requirements =='
cat -n .github/requirements-audit.txt
printf '%s\n' '== SEO audit workflow =='
cat -n .github/workflows/seo-audit.yml
printf '%s\n' '== extruct and pyrdfa3 references =='
rg -n -i -C 3 '\b(extruct|pyrdfa3)\b' \
.github/requirements-audit.txt .github/workflows/seo-audit.yml || true
printf '%s\n' '== Workflow YAML parse =='
python3 - <<'PY'
from pathlib import Path
import yaml
path = Path(".github/workflows/seo-audit.yml")
with path.open(encoding="utf-8") as file:
data = yaml.safe_load(file)
print("YAML parsed successfully.")
print("Top-level keys:", list(data))
PYLength of output: 6493 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Diff whitespace check =='
git diff --check "$(git merge-base HEAD origin/main)" HEAD
printf '%s\n' '== YAML syntax check with Ruby standard library =='
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/seo-audit.yml"); puts "YAML parsed successfully."' \
|| printf '%s\n' 'Ruby YAML parser is unavailable or rejected the workflow.'
printf '%s\n' '== Exact JSON-LD validation block =='
sed -n '90,107l' .github/workflows/seo-audit.yml
printf '%s\n' '== Dependency specifiers =='
cat .github/requirements-audit.txtLength of output: 1196 🏁 Script executed: #!/bin/bash
set -u
printf '%s\n' '== YAML syntax check with Ruby standard library =='
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/seo-audit.yml"); puts "YAML parsed successfully."'
else
printf '%s\n' 'Ruby is unavailable.'
fi
printf '%s\n' '== JSON-LD validation block =='
sed -n '90,107p' .github/workflows/seo-audit.yml
printf '%s\n' '== Trailing-whitespace locations =='
git diff --check "$(git merge-base HEAD origin/main)" HEAD || trueLength of output: 1881
The workflow YAML is valid. Please fix these two items before merge:
Replace the current JSON-LD loop with: for index, tag in enumerate(script_tags, start=1):
raw_json_ld = tag.get_text(strip=True)
assert raw_json_ld, f"CRITICAL: JSON-LD block {index} is empty."
try:
json.loads(raw_json_ld)
except json.JSONDecodeError as error:
raise AssertionError(
f"CRITICAL: JSON-LD block {index} is invalid: {error}"
) from errorThis change preserves the intended security fix and makes the JSON-LD validation complete. You are interacting with an AI system. |
|
@CodeRabbit, Now everything is done check and let me know any issue till if no any issue pass the checks |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base HEAD origin/main)"
printf '%s\n' '== Changed files =='
git diff --name-status "$base" HEAD
printf '%s\n' '== Requirements =='
cat -n .github/requirements-audit.txt
printf '%s\n' '== Workflow =='
cat -n .github/workflows/seo-audit.yml
printf '%s\n' '== Removed dependency references =='
rg -n -i -C 2 '\b(extruct|pyrdfa3)\b' \
.github/requirements-audit.txt .github/workflows/seo-audit.yml || true
printf '%s\n' '== Diff whitespace check =='
git diff --check "$base" HEAD
printf '%s\n' '== YAML parse =='
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/seo-audit.yml"); puts "YAML parsed successfully."'
printf '%s\n' '== JSON-LD validation references =='
rg -n -C 8 'json_ld|script_tags|json\.loads|get_text' .github/workflows/seo-audit.ymlLength of output: 7863
The previous Socket supply-chain warning should be resolved after Socket runs again on the updated commit. If you found this review helpful, would you consider giving us a shout-out on X? Thank you for using CodeRabbit! You are interacting with an AI system. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base HEAD origin/main)"
printf '%s\n' '== Changed files =='
git diff --name-status "$base" HEAD
printf '%s\n' '== Whitespace errors =='
git diff --check "$base" HEAD
printf '%s\n' '== Audit dependencies =='
cat -n .github/requirements-audit.txt
printf '%s\n' '== Flagged dependency references =='
rg -n -i -C 3 '\b(extruct|pyrdfa3)\b' \
.github/requirements-audit.txt .github/workflows/seo-audit.yml || true
printf '%s\n' '== Workflow JSON-LD validation and relevant imports =='
rg -n -C 10 '^\s*import json\b|script_tags|json\.loads|get_text\(strip=True\)|application/ld\+json' \
.github/workflows/seo-audit.yml
printf '%s\n' '== Complete workflow =='
cat -n .github/workflows/seo-audit.yml
printf '%s\n' '== Lighthouse configuration =='
cat -n .lighthouserc.json
printf '%s\n' '== Current PR check runs =='
repo="AOSSIE-Org/SocialShareButton"
pr="229"
head_sha="$(gh api "repos/$repo/pulls/$pr" --jq '.head.sha')"
gh api -H 'Accept: application/vnd.github+json' \
"repos/$repo/commits/$head_sha/check-runs" --paginate \
--jq '.check_runs[] | {name, status, conclusion, details_url}'Length of output: 10854 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="AOSSIE-Org/SocialShareButton"
printf '%s\n' '== SEO audit failed-step log =='
gh run view 31310661696 \
--repo "$repo" \
--job 93237884085 \
--log-failed || true
printf '%s\n' '== Dependency and License Review failed-step log =='
gh run view 31310661689 \
--repo "$repo" \
--job 93237883936 \
--log-failed || true
printf '%s\n' '== Job metadata =='
for job_id in 93237884085 93237883936; do
gh api "repos/$repo/actions/jobs/$job_id" \
--jq '{name, conclusion, started_at, completed_at, steps: [.steps[] | {name, status, conclusion, number}]}' || true
doneLength of output: 10367
The Socket checks pass. The previous After you apply the You are interacting with an AI system. |
|
@CodeRabbit , check again and let me know why Coderabbit suggest changes and tell what is the changes needed |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="AOSSIE-Org/SocialShareButton"
pr="229"
base="$(git merge-base HEAD origin/main)"
printf '%s\n' '== Changed files =='
git diff --name-status "$base" HEAD
printf '%s\n' '== Workflow =='
cat -n .github/workflows/seo-audit.yml
printf '%s\n' '== Audit requirements =='
cat -n .github/requirements-audit.txt
printf '%s\n' '== Lighthouse configuration =='
cat -n .lighthouserc.json
printf '%s\n' '== Current CodeRabbit review comments =='
gh api "repos/$repo/pulls/$pr/comments" --paginate --jq \
'.[] | select(.user.login == "coderabbitai[bot]" or .user.login == "coderabbitai") |
{path, line, side, body, html_url, created_at}'
printf '%s\n' '== Current CodeRabbit PR reviews =='
gh api "repos/$repo/pulls/$pr/reviews" --paginate --jq \
'.[] | select(.user.login == "coderabbitai[bot]" or .user.login == "coderabbitai") |
{state, body, submitted_at, html_url}'
printf '%s\n' '== Recent PR issue comments from CodeRabbit =='
gh api "repos/$repo/issues/$pr/comments" --paginate --jq \
'.[] | select(.user.login == "coderabbitai[bot]" or .user.login == "coderabbitai") |
{body, created_at, html_url}' | tail -n 10
printf '%s\n' '== Current check runs =='
head_sha="$(gh api "repos/$repo/pulls/$pr" --jq '.head.sha')"
gh api -H 'Accept: application/vnd.github+json' \
"repos/$repo/commits/$head_sha/check-runs" --paginate \
--jq '.check_runs[] | {name, app: .app.slug, status, conclusion, details_url}'Length of output: 87560 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="AOSSIE-Org/SocialShareButton"
printf '%s\n' '== SEO audit failure log =='
gh run view 31311008156 --repo "$repo" --job 93238723239 --log-failed || true
printf '%s\n' '== Dependency and License Review failure log =='
gh run view 31311008126 --repo "$repo" --job 93238722988 --log-failed || true
printf '%s\n' '== Failed job metadata =='
for job_id in 93238723239 93238722988; do
gh api "repos/$repo/actions/jobs/$job_id" \
--jq '{name, conclusion, started_at, completed_at, steps: [.steps[] | {name, number, status, conclusion}]}'
doneLength of output: 75343
Why CodeRabbit suggested changesCodeRabbit reviewed this PR with the ASSERTIVE profile. It reports workflow security, CI reliability, and functional correctness risks. Most earlier comments are already fixed:
The earlier crawler-input issue is resolved. The crawler completed successfully in the latest failed run. Required changes1. Fix the Lighthouse failureThe current failure is not caused by the crawler.
"preset": "lighthouse:recommended"This preset enables many additional Lighthouse checks as error-level merge gates. The run failed on checks such as:
The configured category threshold also failed: You must choose one of these options:
The first specific accessibility issues to fix are:
2. Make pull request audits test the pull requestThis is the one remaining unresolved CodeRabbit review comment. The workflow checks this fixed URL in every event: For a pull request, that is the current production site. It does not test the changes in the pull request. Use a deployment preview URL for If the project has no preview deployment provider, build and serve the checked-out landing page in the workflow. Then pass the local URL to the crawler, Lighthouse, and Python validation steps. 3. Enable GitHub Dependency graph
A repository administrator must enable Dependency graph in the repository security settings:
This is a repository setting. A workflow or source-code change cannot fix it. Non-blocking warningGitHub warns that
You are interacting with an AI system. |
There was a problem hiding this comment.
♻️ Duplicate comments (5)
.github/workflows/seo-audit.yml (5)
88-90: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winValidate the canonical URL and uniqueness.
soup.find()accepts duplicate canonical elements. The current assertion also accepts an empty or incorrecthref. Require exactly one canonical element and compare its normalized URL withhttps://social-share-button.aossie.org/.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/seo-audit.yml around lines 88 - 90, Update the canonical validation around soup.find to collect all rel='canonical' elements, require exactly one, and validate that its normalized href equals https://social-share-button.aossie.org/. Preserve the diagnostic output while ensuring missing, duplicate, empty, or incorrect canonical URLs fail the assertion.
78-83: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winMake the HTTP probe a bounded enforcement gate.
requests.gethas no timeout. A stalled endpoint can block the job. The code also only prints the response time, so an excessive TTFB passes the audit. Set connect and read timeouts, then assert a documented time budget.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/seo-audit.yml around lines 78 - 83, Update the HTTP probe around requests.get to use explicit bounded connect and read timeouts, and enforce the documented TTFB budget by asserting response.elapsed.total_seconds() does not exceed it. Keep the existing status-code assertion and ensure the timeout and budget values are clearly defined for the audit.
15-15: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winPin all actions to immutable commit SHAs.
Each
uses:reference still uses a mutable tag. This violates the configured static-analysis policy and permits an action tag to change after review.Also applies to: 18-18, 44-44, 50-50, 59-59
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/seo-audit.yml at line 15, Update every uses: reference in the seo-audit workflow, including actions/checkout@v4 and the references at the indicated locations, to immutable commit SHA pins. Preserve each action and its behavior while replacing mutable tags with the corresponding full-length commit SHAs.Source: Linters/SAST tools
49-55: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy liftUse one Lighthouse target URL contract.
The workflow selects production for push and manual runs, but
.lighthouserc.jsonhard-codes localhost. The workflow also does not explicitly load this configuration. Depending on action behavior, assertions can be skipped or production runs can target a non-existent local server.
.github/workflows/seo-audit.yml#L49-L55: explicitly load the assertion configuration and pass the selected audit URL through the supported action interface..lighthouserc.json#L3-L5: remove the fixed localhost collection URL or generate the configuration from the selected audit URL.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/seo-audit.yml around lines 49 - 55, The Lighthouse workflow and configuration use inconsistent target URL contracts. In .github/workflows/seo-audit.yml lines 49-55, explicitly load .lighthouserc.json and pass env.AUDIT_URL through the Lighthouse action’s supported URL interface; in .lighthouserc.json lines 3-5, remove the hard-coded localhost collection URL or generate it from the selected audit URL so production and local runs target the same URL.
63-65: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRemove
extructand validate every JSON-LD block directly.This reintroduces the dependency path that the PR objective states was removed for the Socket warning. It also only requires one extracted object, so an invalid JSON-LD script can pass when another script is valid.
.github/workflows/seo-audit.yml#L63-L65: install only the committed audit requirements needed forrequestsand BeautifulSoup..github/workflows/seo-audit.yml#L75-L75: remove theextructimport..github/workflows/seo-audit.yml#L98-L101: find everyapplication/ld+jsonscript and parse each block withjson.loads; fail on empty or invalid blocks.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/seo-audit.yml around lines 63 - 65, Update .github/workflows/seo-audit.yml at lines 63-65 to install only the committed requirements for requests and BeautifulSoup, remove the extruct import at lines 75-75, and update the JSON-LD validation at lines 98-101 to locate every application/ld+json script, parse each block with json.loads, and fail when any block is empty or invalid.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/seo-audit.yml:
- Around line 88-90: Update the canonical validation around soup.find to collect
all rel='canonical' elements, require exactly one, and validate that its
normalized href equals https://social-share-button.aossie.org/. Preserve the
diagnostic output while ensuring missing, duplicate, empty, or incorrect
canonical URLs fail the assertion.
- Around line 78-83: Update the HTTP probe around requests.get to use explicit
bounded connect and read timeouts, and enforce the documented TTFB budget by
asserting response.elapsed.total_seconds() does not exceed it. Keep the existing
status-code assertion and ensure the timeout and budget values are clearly
defined for the audit.
- Line 15: Update every uses: reference in the seo-audit workflow, including
actions/checkout@v4 and the references at the indicated locations, to immutable
commit SHA pins. Preserve each action and its behavior while replacing mutable
tags with the corresponding full-length commit SHAs.
- Around line 49-55: The Lighthouse workflow and configuration use inconsistent
target URL contracts. In .github/workflows/seo-audit.yml lines 49-55, explicitly
load .lighthouserc.json and pass env.AUDIT_URL through the Lighthouse action’s
supported URL interface; in .lighthouserc.json lines 3-5, remove the hard-coded
localhost collection URL or generate it from the selected audit URL so
production and local runs target the same URL.
- Around line 63-65: Update .github/workflows/seo-audit.yml at lines 63-65 to
install only the committed requirements for requests and BeautifulSoup, remove
the extruct import at lines 75-75, and update the JSON-LD validation at lines
98-101 to locate every application/ld+json script, parse each block with
json.loads, and fail when any block is empty or invalid.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 886da7e1-90aa-4252-b446-b0eb880a3356
📒 Files selected for processing (3)
.github/requirements-audit.txt.github/workflows/seo-audit.yml.lighthouserc.json
💤 Files with no reviewable changes (1)
- .github/requirements-audit.txt
…onical check, remove extruct
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/seo-audit.yml:
- Around line 46-48: Update the PR link-audit step using
Broken-Links-Crawler-Action so the crawler can reach the server started on the
runner at AUDIT_URL (localhost:3000). Replace the Docker-based action path with
a runner-hosted crawler, or place the site and crawler on a shared container
network using a reachable service hostname, while preserving the existing audit
target behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0563f1ae-2fbc-487e-b670-6b430c8c0520
📒 Files selected for processing (2)
.github/workflows/seo-audit.yml.lighthouserc.json
💤 Files with no reviewable changes (1)
- .lighthouserc.json
…localhost support
1 participant
What this PR does
Adds a GitHub Actions workflow (
.github/workflows/seo-audit.yml) that automatically audits the landing page on every push and pull request, so SEO regressions are caught in CI before they reach production.✅ Checks Included
1. 🔗 Broken Links & Images Audit
GayanPradeep/broken-links-crawler@v1to crawl the live site2. 🏆 Lighthouse SEO + Performance + Accessibility Audit
treosh/lighthouse-ci-action@v11to run a full Google Lighthouse auditSeoScoreAPI/seo-audit-action(which requires a paid/free-tier key) to this free, open approach3. 🌐 Canonical Tag Check (
<link rel="canonical">)4. 📝 Single H1 Tag Check
<h1>tag5. 🗂️ JSON-LD Structured Data / Schema Markup Check
extructto parse all JSON-LD blocks on the page6. ⚡ Server Status & TTFB Check
🔀 Triggers
main,developmain🧪 How to Verify
AssertionErrorSummary by CodeRabbit